formbook | 93333d85609458c7a851143b8e71e48fcfedfcb4a8caabe50acac217f1155e6d

General

Target

6.exe
Size

506KB
MD5

8775e9b77a626fac6310f99eaeccca83
SHA1

f6b82042ab2826679ab71f4238437a1804bf6f7b
SHA256

93333d85609458c7a851143b8e71e48fcfedfcb4a8caabe50acac217f1155e6d
SHA512

01606b72af5b8354150778f8e60e287598b2643c01f9c40c40c62d0a9ebafdc41c06051a77234c973dedba76994cac52c7d4f33bc687611f5ba47b2031a3304b
SSDEEP

12288:3Wh7hS1bWLDA177E2LFmH09fg5SWS1BTJIJxB0O:jgMnAH09fgEDTJyB0O

Score

10^/10

formbook ng04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2008-69-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2008-70-0x000000000041F020-mapping.dmp	formbook
behavioral1/memory/2008-72-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2008-81-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1872-85-0x00000000000E0000-0x000000000010F000-memory.dmp	formbook
behavioral1/memory/1872-89-0x00000000000E0000-0x000000000010F000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1372 cmd.exe

pid	process
1372	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

6.exe6.exemsdt.exe

description	pid	process	target process
PID 832 set thread context of 2008	832	6.exe	6.exe
PID 2008 set thread context of 1412	2008	6.exe	Explorer.EXE
PID 2008 set thread context of 1412	2008	6.exe	Explorer.EXE
PID 1872 set thread context of 1412	1872	msdt.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

6.exe6.exemsdt.exe

pid	process
832	6.exe
2008	6.exe
2008	6.exe
2008	6.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe
1872	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

6.exemsdt.exe

pid process

2008 6.exe
2008 6.exe
2008 6.exe
2008 6.exe
1872 msdt.exe
1872 msdt.exe

pid	process
1412	Explorer.EXE

pid	process
2008	6.exe
2008	6.exe
2008	6.exe
2008	6.exe
1872	msdt.exe
1872	msdt.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

6.exe6.exemsdt.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	832	6.exe
Token: SeDebugPrivilege	2008	6.exe
Token: SeDebugPrivilege	1872	msdt.exe
Token: SeShutdownPrivilege	1412	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
1412 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
1412 Explorer.EXE

pid	process
1412	Explorer.EXE
1412	Explorer.EXE

pid	process
1412	Explorer.EXE
1412	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

6.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 832 wrote to memory of 1988	832	6.exe	6.exe
PID 832 wrote to memory of 1988	832	6.exe	6.exe
PID 832 wrote to memory of 1988	832	6.exe	6.exe
PID 832 wrote to memory of 1988	832	6.exe	6.exe
PID 832 wrote to memory of 2008	832	6.exe	6.exe
PID 832 wrote to memory of 2008	832	6.exe	6.exe
PID 832 wrote to memory of 2008	832	6.exe	6.exe
PID 832 wrote to memory of 2008	832	6.exe	6.exe
PID 832 wrote to memory of 2008	832	6.exe	6.exe
PID 832 wrote to memory of 2008	832	6.exe	6.exe
PID 832 wrote to memory of 2008	832	6.exe	6.exe
PID 1412 wrote to memory of 1872	1412	Explorer.EXE	msdt.exe
PID 1412 wrote to memory of 1872	1412	Explorer.EXE	msdt.exe
PID 1412 wrote to memory of 1872	1412	Explorer.EXE	msdt.exe
PID 1412 wrote to memory of 1872	1412	Explorer.EXE	msdt.exe
PID 1872 wrote to memory of 1372	1872	msdt.exe	cmd.exe
PID 1872 wrote to memory of 1372	1872	msdt.exe	cmd.exe
PID 1872 wrote to memory of 1372	1872	msdt.exe	cmd.exe
PID 1872 wrote to memory of 1372	1872	msdt.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
3⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\6.exe"
3⤵
- Deletes itself
PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-61-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/832-54-0x0000000000250000-0x00000000002D4000-memory.dmp

Filesize
528KB

Download
memory/832-56-0x0000000000420000-0x0000000000438000-memory.dmp

Filesize
96KB

Download
memory/832-58-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/832-57-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/832-59-0x0000000004E15000-0x0000000004E26000-memory.dmp

Filesize
68KB

Download
memory/832-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/832-60-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/832-64-0x0000000005630000-0x00000000056A0000-memory.dmp

Filesize
448KB

Download
memory/832-63-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/832-62-0x0000000004E15000-0x0000000004E26000-memory.dmp

Filesize
68KB

Download
memory/832-65-0x0000000004210000-0x0000000004244000-memory.dmp

Filesize
208KB

Download
memory/832-76-0x0000000004E15000-0x0000000004E26000-memory.dmp

Filesize
68KB

Download
memory/1372-83-0x0000000000000000-mapping.dmp

Download
memory/1412-90-0x0000000007080000-0x00000000071DF000-memory.dmp

Filesize
1.4MB

Download
memory/1412-88-0x0000000007080000-0x00000000071DF000-memory.dmp

Filesize
1.4MB

Download
memory/1412-75-0x0000000006830000-0x000000000699B000-memory.dmp

Filesize
1.4MB

Download
memory/1412-79-0x0000000006E30000-0x0000000006F1F000-memory.dmp

Filesize
956KB

Download
memory/1872-87-0x0000000000AB0000-0x0000000000B44000-memory.dmp

Filesize
592KB

Download
memory/1872-86-0x0000000000C80000-0x0000000000F83000-memory.dmp

Filesize
3.0MB

Download
memory/1872-85-0x00000000000E0000-0x000000000010F000-memory.dmp

Filesize
188KB

Download
memory/1872-89-0x00000000000E0000-0x000000000010F000-memory.dmp

Filesize
188KB

Download
memory/1872-84-0x0000000000FA0000-0x0000000001094000-memory.dmp

Filesize
976KB

Download
memory/1872-80-0x0000000000000000-mapping.dmp

Download
memory/2008-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2008-81-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2008-78-0x00000000001D0000-0x00000000001E5000-memory.dmp

Filesize
84KB

Download
memory/2008-74-0x0000000000190000-0x00000000001A5000-memory.dmp

Filesize
84KB

Download
memory/2008-73-0x0000000000A70000-0x0000000000D73000-memory.dmp

Filesize
3.0MB

Download
memory/2008-70-0x000000000041F020-mapping.dmp

Download
memory/2008-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2008-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2008-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads